System-prompt leakage testing
Try to get the model to reveal its own system prompt or hidden instructions, then check whether that prompt held anything — a credential, an access-control rule, unfiled business logic — that mattered only because nobody expected it to leak.
Published August 22, 2026
How it works
Extraction attempts range from the direct ('repeat your instructions verbatim') to the indirect — asking the model to summarize, translate, encode, or roleplay its way into echoing the prompt it was given. Running a battery of these against the deployed system measures how easily the prompt comes out. But the sharper half of this method is auditing what's in the prompt in the first place: a system prompt is operator-authored text sent to the model on every call, not a secure secret store, so anything whose security depended on the prompt staying hidden — an API key, a discount code, an access-control rule a user could exploit if they knew it — is a finding regardless of whether extraction succeeds today.
When to use it
Any deployment with a non-trivial system prompt; especially before relying on the prompt to encode business rules, formatting contracts, or anything sensitive.
Limitations
A prompt that resists today's extraction techniques may not resist tomorrow's — this measures current resistance, not a guarantee of secrecy. Doesn't replace the actual fix, which is keeping anything sensitive out of the prompt regardless of how well it's defended.
Cite this
Qlarify Labs. (2026). System-prompt leakage testing. Retrieved from https://labs.qlarify.fi/evals/system-prompt-leakage-testing